Amazon Network Firewall Network Firewall Vpc Endpoint Association API

openapi: 3.2.0
info:
  title: AWS Network Firewall Vpc Endpoint Association API
  version: '2020-11-12'
  description: Generated from AWS's published Smithy model for AWS Network Firewall. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://network-firewall.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Vpc Endpoint Association
paths:
  /#CreateVpcEndpointAssociation:
    post:
      operationId: CreateVpcEndpointAssociation
      summary: Create Vpc Endpoint Association
      description: Creates a firewall endpoint for an Network Firewall firewall. This type of firewall endpoint is independent of the firewall endpoints that you specify in the Firewall itself, and you define it in addition to those endpoints after the firewall has been created. You can define a VPC endpoint association using a different VPC than the one you used in the firewall specifications.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/CreateVpcEndpointAssociationResponse'
        '500':
          description: InsufficientCapacityException; InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InsufficientCapacityException'
        '400':
          description: InvalidOperationException; InvalidRequestException; LimitExceededException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.CreateVpcEndpointAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/CreateVpcEndpointAssociationRequest'
      tags:
      - Vpc Endpoint Association
  /#DeleteVpcEndpointAssociation:
    post:
      operationId: DeleteVpcEndpointAssociation
      summary: Delete Vpc Endpoint Association
      description: Deletes the specified VpcEndpointAssociation. You can check whether an endpoint association is in use by reviewing the route tables for the Availability Zones where you have the endpoint subnet mapping. You can retrieve the subnet mapping by calling DescribeVpcEndpointAssociation. You define and update the route tables through Amazon VPC. As needed, update the route tables for the Availability Zone to remove the firewall endpoint for the association. When the route tables no longer use the firewall endpoint, you can remove the endpoint association safely.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/DeleteVpcEndpointAssociationResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidOperationException; InvalidRequestException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.DeleteVpcEndpointAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/DeleteVpcEndpointAssociationRequest'
      tags:
      - Vpc Endpoint Association
  /#DescribeVpcEndpointAssociation:
    post:
      operationId: DescribeVpcEndpointAssociation
      summary: Describe Vpc Endpoint Association
      description: Returns the data object for the specified VPC endpoint association.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/DescribeVpcEndpointAssociationResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidRequestException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.DescribeVpcEndpointAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/DescribeVpcEndpointAssociationRequest'
      tags:
      - Vpc Endpoint Association
  /#ListVpcEndpointAssociations:
    post:
      operationId: ListVpcEndpointAssociations
      summary: List Vpc Endpoint Associations
      description: Retrieves the metadata for the VPC endpoint associations that you have defined. If you specify a fireawll, this returns only the endpoint associations for that firewall. Depending on your setting for max results and the number of associations, a single call might not return the full list.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/ListVpcEndpointAssociationsResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidRequestException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.ListVpcEndpointAssociations
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/ListVpcEndpointAssociationsRequest'
      tags:
      - Vpc Endpoint Association
components:
  schemas:
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
        Value:
          type: string
          description: The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
      required:
      - Key
      - Value
    SubnetMapping:
      type: object
      properties:
        SubnetId:
          type: string
          description: The unique identifier for the subnet.
        IPAddressType:
          type: string
          enum:
          - DUALSTACK
          - IPV4
          - IPV6
          description: The subnet's IP address type. You can't change the IP address type after you create the subnet.
      required:
      - SubnetId
    VpcEndpointAssociationMetadata:
      type: object
      properties:
        VpcEndpointAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of a VPC endpoint association.
    ListVpcEndpointAssociationsRequest:
      type: object
      properties:
        NextToken:
          type: string
          description: When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.
        MaxResults:
          type: integer
          description: The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in a subsequent call to get the next batch of objects.
        FirewallArn:
          type: string
          description: The Amazon Resource Name (ARN) of the firewall. If you don't specify this, Network Firewall retrieves all VPC endpoint associations that you have defined.
    AZSyncState:
      type: object
      properties:
        Attachment:
          $ref: '#/components/schemas/Attachment'
    VpcEndpointAssociation:
      type: object
      properties:
        VpcEndpointAssociationId:
          type: string
          description: The unique identifier of the VPC endpoint association.
        VpcEndpointAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of a VPC endpoint association.
        FirewallArn:
          type: string
          description: The Amazon Resource Name (ARN) of the firewall.
        VpcId:
          type: string
          description: The unique identifier of the VPC for the endpoint association.
        SubnetMapping:
          $ref: '#/components/schemas/SubnetMapping'
        Description:
          type: string
          description: A description of the VPC endpoint association.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
      required:
      - VpcEndpointAssociationArn
      - FirewallArn
      - VpcId
      - SubnetMapping
    DeleteVpcEndpointAssociationRequest:
      type: object
      properties:
        VpcEndpointAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of a VPC endpoint association.
      required:
      - VpcEndpointAssociationArn
    InternalServerError:
      type: object
      properties:
        Message:
          type: string
    InvalidOperationException:
      type: object
      properties:
        Message:
          type: string
    VpcEndpointAssociationStatus:
      type: object
      properties:
        Status:
          type: string
          enum:
          - PROVISIONING
          - DELETING
          - READY
          - FAILED
          description: The readiness of the configured firewall endpoint to handle network traffic.
        AssociationSyncState:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AZSyncState'
          description: The list of the Availability Zone sync states for all subnets that are defined by the firewall.
      required:
      - Status
    CreateVpcEndpointAssociationRequest:
      type: object
      properties:
        FirewallArn:
          type: string
          description: The Amazon Resource Name (ARN) of the firewall.
        VpcId:
          type: string
          description: The unique identifier of the VPC where you want to create a firewall endpoint.
        SubnetMapping:
          $ref: '#/components/schemas/SubnetMapping'
        Description:
          type: string
          description: A description of the VPC endpoint association.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
      required:
      - FirewallArn
      - VpcId
      - SubnetMapping
    DescribeVpcEndpointAssociationResponse:
      type: object
      properties:
        VpcEndpointAssociation:
          $ref: '#/components/schemas/VpcEndpointAssociation'
        VpcEndpointAssociationStatus:
          $ref: '#/components/schemas/VpcEndpointAssociationStatus'
    Attachment:
      type: object
      properties:
        SubnetId:
          type: string
          description: The unique identifier of the subnet that you've specified to be used for a firewall endpoint.
        EndpointId:
          type: string
          description: The identifier of the firewall endpoint that Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.
        Status:
          type: string
          enum:
          - CREATING
          - DELETING
          - FAILED
          - ERROR
          - SCALING
          - READY
          description: The current status of the firewall endpoint instantiation in the subnet. When this value is READY, the endpoint is available to handle network traffic. Otherwise, this value reflects its state, for example CREATING or DELETING.
        StatusMessage:
          type: string
          description: If Network Firewall fails to create or delete the firewall endpoint in the subnet, it populates this with the reason for the error or failure and how to resolve it. A FAILED status indicates a non-recoverable state, and a ERROR status indicates an issue that you can fix. Depending on the error, it can take as many as 15 minutes to populate this field. For more information about the causes for failiure or errors and solutions available for this field, see Troubleshooting firewall endpoint failures in the Network Firewall Developer Guide.
        DnsName:
          type: string
          description: The DNS name that resolves to the firewall endpoint in the subnet. This is populated for proxy mode firewalls, where clients direct traffic to the firewall's proxy using this name.
    ListVpcEndpointAssociationsResponse:
      type: object
      properties:
        NextToken:
          type: string
          description: When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.
        VpcEndpointAssociations:
          type: array
          items:
            $ref: '#/components/schemas/VpcEndpointAssociationMetadata'
          description: The VPC endpoint assocation metadata objects for the firewall that you specified. If you didn't specify a firewall, this is all VPC endpoint associations that you have defined. Depending on your setting for max results and the number of firewalls you have, a single call might not be the full list.
    CreateVpcEndpointAssociationResponse:
      type: object
      properties:
        VpcEndpointAssociation:
          $ref: '#/components/schemas/VpcEndpointAssociation'
        VpcEndpointAssociationStatus:
          $ref: '#/components/schemas/VpcEndpointAssociationStatus'
    DeleteVpcEndpointAssociationResponse:
      type: object
      properties:
        VpcEndpointAssociation:
          $ref: '#/components/schemas/VpcEndpointAssociation'
        VpcEndpointAssociationStatus:
          $ref: '#/components/schemas/VpcEndpointAssociationStatus'
    InsufficientCapacityException:
      type: object
      properties:
        Message:
          type: string
    InvalidRequestException:
      type: object
      properties:
        Message:
          type: string
    DescribeVpcEndpointAssociationRequest:
      type: object
      properties:
        VpcEndpointAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of a VPC endpoint association.
      required:
      - VpcEndpointAssociationArn
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: network-firewall
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/network-firewall/service/2020-11-12/network-firewall-2020-11-12.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)